Biometric authentication: a model to follow?

Biometric authentication: a technology (of the future) that already exists

Biometric authentication is designed to ensure that user credentials are as secure as possible, and that logins to devices, software, and services on the Internet, as well as access to specific locations in the enterprise, are maximally secure. However, in biometric authentication, security, usability and privacy (or data protection) should also be complementary, not mutually exclusive. The security offered by biometrics implies a high level of trust in the identity provided by the user and enables the use of strong authentication applications for access to many digital services.

Ease of use enables true user adoption of biometrics by making logins easier and reducing the need for employees to remember passwords. Facial recognition or fingerprints can even completely replace traditional username and password logon methods.

Biometrics and the industry

According to Gartner, « Many data breaches are caused by security and identity tools that have been configured incorrectly or incompletely, or whose configuration is outdated. » With stolen credentials, hackers can easily log into the network, often still over the Internet, and benefit from the user’s privileges to carry out their criminal activities on the network. This is what biometric authentication is supposed to prevent.

In industrial operations, it makes it possible to protect endpoints in the network just as effectively as sensitive production areas or important machines.

How does biometric authentication work?

With biometric authentication, users log on to a system with distinctive biological characteristics. This can involve fingerprint scans and facial recognition, but also more complex logon systems with DNA matching, retinal scans, vein scans or even behavioral biometrics. A combination of these systems is also conceivable.

When logging in with biometric authentication, the biometric information is verified so that it belongs to the corresponding user. The data from the biometrics system, for example in the case of facial recognition, is captured, converted into numerical data and stored in a database. When a user logs on, the biometric system compares the captured data with the logon data and allows or denies access.

Data protection with biometric authentication

The data stored is therefore conventional digital information that must also be protected accordingly. If attackers gain access to the database, they can manipulate or read out data. Both bring problems with them, as the data is personal and is subject to the GDPR. Therefore, responsible managers should make sure that the data is first secured in such a way that it is maximally protected against hackers. When using biometric logon methods in the European Union, the storage of this personal data must also take place in locations that are permissible under the GDPR, generally in data centers within the EU.

Biometric authentication can be hacked

If biometric authentication seems to be secure, it can also be hacked. In addition to accessing the database where credentials are stored, it is also possible to use artificial intelligence to trick the systems. Modern AI algorithms can generate fingerprints to fool fingerprint scanners.

This is in addition to exploiting vulnerabilities in the registration and processing of process data for enrollment. Cheap biometric systems can often be fooled in facial recognition photos or 3D printing, and even expensive solutions are not one hundred percent secure. Such « presentation attacks » are on the rise as more companies rely on biometrics. It is therefore necessary to integrate further security mechanisms to complement biometric authentication. However, user-friendliness and data protection must not suffer in the process. There are a number of options.

Those responsible should not forget that biometric procedures are by no means perfectly protected against hackers, but they are still significantly better than conventional logon procedures with usernames and passwords. Biometric systems are secure and can be made even more so with a little optimization and combination of technologies.

Multimodal biometric authentication combines technologies for more security

In order to increase security while maintaining usability, the best way is to combine biometric authentication methods to improve security. Of course, the data is still stored in databases that IT experts must protect, and data protection must not be neglected.

If companies combine biometric authentication technologies and incorporate various biometric data, security increases significantly. It is very difficult for attackers to capture different biometric data at the same time and use it in the right time window. A facial recognition system can be fooled by a photo under certain circumstances. However, if a fingerprint sensor is used in parallel, this makes logging in more secure.

Behavior-based biometrics supplemented by multimodal biometric authentication

Behavior-based authentication is often used in addition to biometric authentication. In this case, the system can confirm a user’s identity by analyzing physical or cognitive behavior. In doing so, the environment can access touch screen usage or analyze typing speed. Mouse activity can also be measured and tracked. The approach of combining multimodal biometrics and behavior-based biometrics makes it so security is maximized. Once hackers have captured credentials, possibly even several different credentials, it is difficult for them to also mimic the user’s behavior in such a way that the system accepts the fake login.

Zero Trust models can be implemented much more effectively with biometric authentication

The Zero Trust approach follows a strategy based on the guiding principle: « Trust no one, verify everyone ». Zero Trust is a security model based on authentication and authorization at all data points. User rights are restricted to the absolute minimum. In addition, there are constant checks of the security options, encryption and analysis of the security structure.

In Zero Trust environments, the infrastructure initially assumes an attack for all accesses and therefore requires authentication for all user actions and all resource accesses. This approach is maximally secure, but requires users to constantly log in, which is cumbersome with traditional login names with passwords. Because uusers are much quicker to accept new technologies if they are easier to use.

With biometrics, logon is again effective, fast, secure and, most importantly, very user-friendly. As a result, in many cases users do not even notice that they have just authenticated themselves, because the facial recognition system in the notebook has performed the process automatically.